Adware.LinkSwift

Posted: September 12, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	7,711
Threat Level:	2/10
Infected PCs:	34,689

First Seen:	September 12, 2013
Last Seen:	January 16, 2025
OS(es) Affected:	Windows

Adware.LinkSwift is an adware program that uses pop-ups and browser redirects to display advertisements unrelated to your Web-browsing activities. Although Adware.LinkSwift does include a theoretically functional uninstall tool, malware experts found that using this tool left components of Adware.LinkSwift behind on the affected computer. Additionally, Adware.LinkSwift often is found in the presence of other PC threats and tends to cause general browser performance issues. As is the case for most types of adware, deleting Adware.LinkSwift with appropriate anti-malware programs is your best bet for stabilizing your browser and preventing any future advertisements from displaying without your consent.

Adware.LinkSwift: Swift Links to Content You Probably Don't Want

With compatibility currently confirmed only for Internet Explorer, Adware.LinkSwift is a program designed to display advertisements regularly while you browse the Web – even if you don't want them. Although malware experts have not classified advertising content from Adware.LinkSwift as being definitively malevolent, Adware.LinkSwift does display these advertisements automatically and does not offer any options for disabling them. One of the most side effects of an Adware.LinkSwift infection also is browser performance issues, such as slowdowns and poor Web page loading times, which may be caused by Adware.LinkSwift's resource usage or insistence on forcing your browser to load additional content by default. These advertisements have been seen in two formats thus far: pop-up windows and browser hijacks redirecting you to other sites arbitrarily.

Adware.LinkSwift's history is one that's full of incidents of Adware.LinkSwift being installed without the permission of the PC user, much like its display of advertisements. When considered by itself, Adware.LinkSwift only is a low-level PC threat, but Adware.LinkSwift often is installed with one or more other PC threats that may include additional security issues of their own. Adware.LinkSwift often is installed along with PUPs and questionable toolbars, particularly those related to Delta-search.com and other search sites. Homepage and search engine redirects are the most typical symptoms of these Potentially Unwanted Programs, along with the problems caused by Adware.LinkSwift by itself.

Beating Adware to the Punch on Controlling Your Web Browser

Adware.LinkSwift and other adware programs that control what type of Web pages are loaded in your browser always are security issues to be resolved expediently, and this continues to be true even if the advertisements shown by Adware.LinkSwift's attacks are non-malicious. Because many PC users have experienced major difficulties in deleting Adware.LinkSwift through its supposed uninstall tool, SpywareRemove.com malware experts encourage anti-malware-based solutions and software for removing Adware.LinkSwift. This is specific pertinent in light of the fact that Adware.LinkSwift often is not the only PC threat installed to your computer without your consent.

Free software websites, spammed e-mail file attachments, spammed social networking links and fake advertisements are some of the many infection vectors that may be abused by Adware.LinkSwift. Adware.LinkSwift usually may not be installed alone, and SpywareRemove.com malware researchers consider software bundles to be the most likely source of an Adware.LinkSwift infection.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

C:\Program Files (x86)\LinkSwift\updateLinkSwift.exe

File name: updateLinkSwift.exe
Size: 206.62 KB (206624 bytes)
MD5: dc4d31a8bab280a535376b7c44c81cd0
Detection count: 5,633
File type: Executable File
Mime Type: unknown/exe
Path: C:\Program Files (x86)\LinkSwift\updateLinkSwift.exe
Group: Malware file
Last Updated: January 16, 2021

%PROGRAMFILES(x86)%\LinkSwift\updater.exe

File name: updater.exe
Size: 50.46 KB (50464 bytes)
MD5: 0b9c8589c0bcdd8ac33e177ef4f44a96
Detection count: 286
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\LinkSwift
Group: Malware file
Last Updated: November 25, 2013

%WINDIR%\System32\drivers\{25d71abf-7776-46f5-a269-9951331f9030}t.sys

File name: {25d71abf-7776-46f5-a269-9951331f9030}t.sys
Size: 55.22 KB (55224 bytes)
MD5: a8e2fe9a28a55db99f21a7fbe6a072a0
Detection count: 152
File type: System file
Mime Type: unknown/sys
Path: %WINDIR%\System32\drivers
Group: Malware file
Last Updated: November 27, 2019

%WINDIR%\System32\drivers\{25d71abf-7776-46f5-a269-9951331f9030}Gw.sys

File name: {25d71abf-7776-46f5-a269-9951331f9030}Gw.sys
Size: 52.92 KB (52920 bytes)
MD5: 96100423c810c537ff3658ec42420999
Detection count: 75
File type: System file
Mime Type: unknown/sys
Path: %WINDIR%\System32\drivers
Group: Malware file
Last Updated: October 6, 2014

C:\Program Files (x86)\LinkSwift\LinkSwift.Common.dll

File name: LinkSwift.Common.dll
Size: 14.11 KB (14112 bytes)
MD5: 2fe4fff249d0bb8b53c93c5025fdbe86
Detection count: 23
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\Program Files (x86)\LinkSwift\LinkSwift.Common.dll
Group: Malware file
Last Updated: January 16, 2021

system32\drivers\{25d71abf-7776-46f5-a269-9951331f9030}Gw64.sys

File name: {25d71abf-7776-46f5-a269-9951331f9030}Gw64.sys
Size: 61.11 KB (61112 bytes)
MD5: aea0d1ab9b4f603c803f046ed558c752
Detection count: 5
File type: System file
Mime Type: unknown/sys
Path: system32\drivers
Group: Malware file
Last Updated: July 11, 2014

More files

Registry Modifications

The following newly produced Registry Values are:

CLSID{323420b6-65e5-4657-8106-a27392d4d4aa}{339CA35C-F74A-44C3-BD78-9CE3E8C9C560}{49FB101A-0A00-4E85-A807-8785C2D32604}{62E29692-5062-40FE-9989-1A9E9B8F76A5}File name without pathhttp_static.linkswift.co_0.localstoragehttp_static.linkswift.co_0.localstorage-journalHKEY..\..\..\..{RegistryKeys}Software\LinkSwiftSoftware\Microsoft\Internet Explorer\Approved Extensions\{323420B6-65E5-4657-8106-A27392D4D4AA}Software\Microsoft\Internet Explorer\DOMStorage\linkswift.coSOFTWARE\Microsoft\Tracing\updateLinkSwift_RASAPI32SOFTWARE\Microsoft\Tracing\updateLinkSwift_RASMANCSSOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{323420b6-65e5-4657-8106-a27392d4d4aa}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{323420B6-65E5-4657-8106-A27392D4D4AA}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{323420B6-65E5-4657-8106-A27392D4D4AA}SOFTWARE\Wow6432Node\LinkSwiftSOFTWARE\Wow6432Node\Microsoft\Tracing\updateLinkSwift_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\updateLinkSwift_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{323420b6-65e5-4657-8106-a27392d4d4aa}SYSTEM\ControlSet001\services\eventlog\Application\Update LinkSwiftSYSTEM\ControlSet001\services\eventlog\Application\Util LinkSwiftSYSTEM\ControlSet001\services\Update LinkSwiftSYSTEM\ControlSet001\services\Util LinkSwiftSYSTEM\ControlSet002\services\eventlog\Application\Util LinkSwiftSYSTEM\ControlSet002\services\Util LinkSwiftSYSTEM\CurrentControlSet\services\eventlog\Application\Update LinkSwiftSYSTEM\CurrentControlSet\services\eventlog\Application\Util LinkSwiftSYSTEM\CurrentControlSet\services\Update LinkSwiftSYSTEM\CurrentControlSet\services\Util LinkSwiftHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}LinkSwift

Additional Information

The following directories were created:

%PROGRAMFILES%\LinkSwift%PROGRAMFILES(x86)%\LinkSwift%TEMP%\LinkSwift

The following URL's were detected:

LinkSwift